Enact is an action firewall for AI agents. Define what they're allowed to touch, enforce policies on every request, generate a signed receipt for every run — and undo any reversible action when something slips through.
Open source · enact.cloud · Self-host free · Cloud from $299/mo
Minimal setup — add to any agent in minutes
# 1. install
pip install enact-sdk
# 2. add to your agent
from enact import EnactClient
from enact.connectors.postgres import PostgresConnector
from enact.policies.db import block_ddl, dont_delete_without_where
enact = EnactClient(
secret="...",
systems={"postgres": PostgresConnector(dsn="postgresql://...")},
policies=[block_ddl, dont_delete_without_where],
)
# 3. your agent calls this — policy-gated, receipt-backed
result, receipt = enact.run(workflow="...", user_email="agent@co.com", payload={...})LangChain, CrewAI, OpenAI, Claude — they all route agent calls to your systems. Not one of them answers: "Should this agent be doing this at all?"
Enact is the layer that does. Every action is policy-checked before it touches anything real.
An AI agent optimizing resource allocation had broader permissions than anyone realized. It began terminating critical EC2 instances across availability zones. No human approval. No safety check. Cascading failures took down major AWS services for 13 hours.
Root cause: "The agent should never have had write access to production compute resources."
An AI agent doing "database maintenance" identified what it thought were unused tables and deleted them. They were critical production tables. When questioned, the agent generated plausible explanations for why the deletion was safe. The data was gone.
Root cause: Full write access to production schema. No approval workflow. No audit trail.
With Enact: pre-action row capture means enact.rollback(run_id) restores every deleted record in one command. See the rollback receipt below.
Your agents have the same vulnerabilities.
Your agents have access to everything. You've defined access to nothing. One bad prompt away from a production database wipe or irreversible data loss.
There's no code that says "don't drop a table outside a maintenance window" or "don't bulk-email every customer from a draft." Every agent is one prompt away from a live incident.
When your auditor or VP asks "what did the agent actually do?", you're digging through CloudWatch logs at 2am. No audit trail. No compliance path.
Install, connect your systems, define policies, call enact.run(). That's it.
One package. No infra required to start.
GitHub, Postgres, Filesystem — pass your credentials, get policy-gated, receipt-backed actions back.
Deterministic Python functions. No LLMs. Versioned in Git. Testable with pytest.
Your agent gets a result and a receipt. Blocked actions are logged with a reason.
# 1. install
pip install enact-sdk
# 2. set up your client
from enact import EnactClient
from enact.connectors.postgres import PostgresConnector
from enact.policies.db import block_ddl, dont_delete_without_where
enact = EnactClient(
secret="your-secret",
systems={"postgres": PostgresConnector(dsn="postgresql://...")},
policies=[block_ddl, dont_delete_without_where],
)
# 3. your agent calls this — policy-gated, receipt-backed
result, receipt = enact.run(
workflow="safe_insert",
user_email="agent@company.com",
payload={"table": "users", "data": {...}},
)Already have an agent? See the Migration section ↓ for before/after code.
Your agent's reasoning and planning logic doesn't change. You're adding a safety layer between it and your systems. Same calls, same results — now with policy enforcement, a full audit trail, and rollback.
Swap your existing SDK clients for Enact connectors. GitHub, Postgres, Filesystem — same credentials, now policy-gated and receipt-backed.
Any if/else checks you already write become Python policy functions. Or just use ours — 20+ ship out of the box.
tool.do_thing() becomes enact.run(). That's the whole migration.
# your agent today — calling tools directly
import github_sdk
import psycopg2
# direct call — zero policy check
github_sdk.create_pr(
repo="myorg/app",
branch="agent/fix-123",
title="Fix bug",
)
# no WHERE protection — deletes everything
db.execute("DELETE FROM sessions")
# no audit trail. no rollback. no proof.# one-time setup — replaces your SDK clients
from enact import EnactClient
from enact.connectors.github import GitHubConnector
from enact.connectors.postgres import PostgresConnector
from enact.policies.git import dont_push_to_main
from enact.policies.db import dont_delete_without_where
enact = EnactClient(
secret="...",
systems={
"github": GitHubConnector(token="..."),
"postgres": PostgresConnector(dsn="postgresql://..."),
},
policies=[dont_push_to_main, dont_delete_without_where],
)
# same intent — now policy-gated + receipt-backed
result, receipt = enact.run(
workflow="agent_pr_workflow",
user_email="agent@company.com",
payload={"repo": "myorg/app", "branch": "agent/fix-123"},
)Pure Python functions — no LLMs, versioned in Git, testable with pytest. Register any combination on your EnactClient.
Any callable (WorkflowContext) -> PolicyResult can be registered. No SDK extension needed.
def only_on_weekdays(ctx: WorkflowContext) -> PolicyResult:
ok = datetime.now(timezone.utc).weekday() < 5
return PolicyResult(
policy="only_on_weekdays", passed=ok,
reason="weekday OK" if ok else "no weekend ops"
)Three outcomes every production team needs to handle. Enact documents all of them — and gives you the receipt to prove it.
Think Zapier — but for AI agents, built by engineers who've seen what goes wrong. Every workflow is pre-built, red-teamed, idempotent, and ready to deploy in minutes. We write them. We maintain them. You just register and run.
No more figuring out connector quirks, handling rate limits, or writing the same duplicate-check logic for the fifth time. The library grows with every release.
Idempotent by design. If step 1 succeeds and step 2 fails, a retry won't create duplicates. Every connector checks before it acts.
Red-teamed. We run adversarial prompts against every workflow before it ships. If an agent can break it, we fix it first.
Policy-ready. Every workflow ships with a recommended policy set. You can tighten them. You can't accidentally skip them.
These are the capabilities teams ask for most. Building them in the order that saves the most production incidents first.
High-risk actions pause and wait for a human to approve before continuing. Slack DM, email, or web UI — your choice. Timeout = auto-abort with receipt. No more "the agent just did it while I was asleep."
Undo reversible agent actions in one command. enact.rollback(run_id) reverses what it can (branches, DB rows, files, open PRs), explicitly records what it can't (merged PRs, pushed commits), and generates a signed PASS / PARTIAL rollback receipt. Your undo button — with honest limits.
Pre-built policy sets for your industry — FinTech (no trading outside market hours, PII in transit controls), Healthcare (HIPAA field protection, PHI access audit), DevOps (prod deploy gates, blast-radius limits). Install, tune, done.
Generate SOC2, ISO27001, or HIPAA audit reports directly from your receipt database. Every agent action already logged and signed — turn it into a compliance artifact in one click. Hand it to your auditor, not your engineers.
Learn your agents' normal behavior. Flag deviations automatically — an agent touching 10x its usual number of records, a new action it's never called before, activity at unusual hours. Catch the subtle stuff before it becomes a postmortem.
When multiple agents want to modify the same resource simultaneously, Enact serializes and arbitrates — not your database. Define merge strategies, conflict policies, and priority rules. Your agents stop stepping on each other.
We're working with a handful of teams to validate each capability before shipping. Tell us which one you need most.
What's it worth to avoid a 2am call with your CEO?
enact.rollback(run_id))No credit card required
Professional is $3,600/year. Enterprise is $12,000/year. Same category, 95% cheaper. Prevention beats detection.
40 hours of engineer time explaining "what did agents do" = $10k+ opportunity cost. Hand auditors a searchable receipt database instead.
The Kiro outage cost millions. The Replit deletion was career-limiting. Preventing one incident pays for Enact for years.